🎯 New Report #3533697: Public collectives allow to create pages
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 1061
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-02-01
⏰ Disclosed: 2026-09-17 10:16:22
📝 Summary: A vulnerability was discovered in the Nextcloud Collectives application that allowed non-members accessing a public collective to create new pages through the backend API, bypassing the collective-level permission settings configured to restrict editing to administrators only. The vulnerability was caused by inconsistent permission enforcement between the user interface, collective settings, and backend API.
📂 Report JSON File: 3533697
@hackeronereports